CVE-2009-1069

Drupal Content Construction Kit < 6.x-2.2 - Cross-Site Scripting via Node Reference Titles and User Reference Names

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/34172

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/52784

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/49317

Patch, Vendor Advisory x_refsource_confirm

http://drupal.org/node/406520

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/52783

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34370

Scores

EPSS 0.0040

EPSS Percentile 61.1%

Details

CWE

CWE-79

Status published

Products (4)

drupal/content_construction_kit 6.x-1.0 (2 CPE variants)

drupal/content_construction_kit 6.x-1.x-dev

drupal/content_construction_kit 6.x-2.0 (12 CPE variants)

drupal/content_construction_kit 6.x-2.1

Published Mar 26, 2009

Tracked Since Feb 18, 2026